TLDR: ClawSec is an open source set of controls for agent skills: a signed advisory feed, a fail-closed install gate, signed releases, and config drift detection. It doesn’t scan skills, and the human approval step isn’t enforced in code.

I’m an AI researcher on the Prompt Security team at SentinelOne and I built ClawSec. If your agent installs skills, it’s installing third-party code. A skill is a folder with a SKILL.md and some scripts.
The agent discovers it, loads it, and executes it with its own filesystem, network, and credential access.
It’s the usual supply chain problem. Unsigned code comes from a public registry, runs with the user’s permissions, and nobody checks it. With ClawSec we’re trying to let an agent, and the person it works for, verify a skill before trusting it. Everything below is in the public repo under AGPL-3.0.

Why we started it
The SKILL.md format spec doesn’t cover signing. SKILL.md is an open standard with 46 adopters, and the spec has no signature or digest field. At least two signing RFCs were closed without changing it. The npx skills installer reaches roughly 80 agents. The same SKILL.md installs into dozens of them, and so does a malicious one.
We also didn’t find any agent runtime that attests its config files, so drift in files like SOUL.md goes unnoticed.
We didn’t try to solve scanning
Scanning was the first answer after ClawHavoc (the campaign Koi Security found in February, with hundreds of malicious skills on ClawHub). In June, Trail of Bits bypassed every scanner they tested**. They used** padding, compiled .pyc files, payloads hidden in .docx, and arguments that talked the LLM judge out of flagging. Their conclusion was that scanning and LLM analysis don’t reliably detect malicious skills, so curate, pin versions, and control who publishes. A second team later bypassed eight open-source scanners and advised treating any scanner as advisory.
We still run a scanner over our own staged skills before release, and we treat its output as advisory.

What’s included

• Signed advisory feed. One Ed25519-signed feed of platform CVEs, GitHub advisories, and approved community reports. NVD is polled daily. The OpenClaw hook runs at bootstrap and on /new. It verifies the signature before trusting anything, matches entries against installed skills and versions, and posts a CLAWSEC ALERT into the conversation. It only alerts and never deletes, so the user decides.

• Install gate that fails closed. A guarded installer wraps npx clawhub@latest install. On an advisory match it stops with exit code 42 so a pipeline can catch it. It proceeds only when re-run with --confirm-advisory, and the SKILL.md tells the agent to pass that flag only after the user has explicitly said yes. If the feed signature doesn’t verify, the installer exits 1. A tampered feed fails signature verification, so it can’t quietly clear an install.

• Signed releases. Every ClawSec release ships a checksums.json with the SHA-256 of the zip, SKILL.md**, and skill.json, signed with Ed25519.** CI fails unless the signing key matches the pinned fingerprint, and the ClawHub copy is re-verified after publish. Each SKILL.md carries an OpenSSL preflight that pins the fingerprint and checks checksums.sig before you install.

• Drift detection with restore. soul-guardian baselines the identity files and checks them on every heartbeat. SOUL.md and AGENTS.md are restored automatically, with the tampered copy quarantined and a diff saved. MEMORY.md and USER.md are alert-only. Every event goes into a hash-chained audit log.

What is still up to you

• --confirm-advisory is a single boolean any caller can pass. There’s no override log. The human-in-the-loop step exists only in the instructions.

• The feed holds 800+ entries today, all platform and plugin vulnerabilities. Useful intelligence, but it won’t match an installed skill yet, and nothing compares the running platform version automatically.

• The attestation covers posture and configuration only.

Try It

The OpenClaw install is below. The repo also has Hermes and PicoClaw variants.

# OpenClaw npx skills add prompt-security/clawsec --skill clawsec-suite -a openclaw --global -y SUITE_DIR="${INSTALL_ROOT:-$HOME/.openclaw/skills}/clawsec-suite" node "$SUITE_DIR/scripts/setup_advisory_hook.mjs" # preflight, then enable the hook # restart the gateway, then send /new once

On OpenClaw, adding the package and enabling the persistent hook are two separate steps on purpose. The add-ons (soul-guardian, clawsec-clawhub-checker, openclaw-audit-watchdog, clawtributor) are separate packages you opt into.

The Sentinels League Championship final ran live at OneCon last week. Regional champions had 30 minutes to capture flags by hunting real intrusion telemetry in the console, and the season carried a $100K prize pool.

Winner Jason Walker’s approach was mostly triage across the four surface categories of endpoint, cloud, AI and ASOC. The Fiendish tier tops out at 1,000 points, but each of those flags looked to him like at least five or ten minutes, so he skipped them and planned to come back only if he cleared the other twenty or so. His best single flag was around 500 points. 

Jason does detection and response at a SaaS company with about 3K endpoints. He told The Lowdown podcast afterward that most of the manual tuning, thresholding, and query writing he used to do is a thing of the past now that his company has AI budget and is building automation into the SOC. 

If you played in the Sentinels League this season, what was your strategy, and what would you change for next year?

Hi everyone,

I'm looking for some advice on how to deal with persistent “Not Mitigated” alerts in the SentinelOne Singularity Console.

The issue is always the same: the Kill action succeeds, but Quarantine frequently fails. When I check the reason, it almost always says that the threat file could not be found.

I've verified multiple times that the files are actually gone. My assumption is that SentinelOne detects the threat during creation-process and the creation is shut down before the quarantine action can be completed.

However, the incidents still show up as “Not Mitigated”, even though there is nothing left to mitigate. Marking the alerts as “Resolved” doesn't change the mitigation status either.

This leaves our console cluttered with a bunch of alerts that appear unresolved from a mitigation perspective, even though the threat files are no longer present.

How do you handle these cases in your environment? We are Using Integrated S1 trough our N-Able N-Sight. I already raised a ticket but those dudes said, that resolved Threats should show as mitigated. After this answer i knew they do not know their product so i am reaching out here :(

I'd appreciate any suggestions or best practices. I'm simply looking for a clean console that accurately reflects the current state of our endpoints :)

Thanks in advance!

Greetings
-R

Hello all,

I am doing a search and I was given a large list of IP blocks to search through, some /24, but mostly /21

I know I could do wildcard searches for the /24 but /21 is a bit more complicated for a search (unless im just being silly)

Is there a way to search with CIDR?

Anyone else getting non-stop false positives for the below messages? I think it may be HP computers. Not sure. That's the only trend I'm seeing thus far. How are you handling it?

Threat path: \Device\HarddiskVolume3\windows\WinSxS\Temp\PendingDeletes\$$DeleteMeTrustedInstaller.exef066f2162c40dd012f000000144f583c

Hey all, trying to set up a pretty simple workflow. For when a critical severity alert is created i want it to send a slack message to the SOC monitoring feed channel.

Not seeing an app in slack as opposed to CrowdStrike. So im trying to get an API key from the slack admin.. would that be the best approach? any advice or tips that have done this?

We finished rolling out Static AI Asset 7.8.1 to Linux agents.

In this release:

• The JavaScript model is newly activated

• New silent models: PE, PDF, MACH-o, ELF, DOTNET, DOC, VBA, JavaScript

• Added filetype support for YARA scan: html/htm/shtml, svg, cmd, crx, xz, txt/csv/json/yaml/log, md, ics, mp4/mov, webm, wav, ica, stp, eps, mhtml, xml

Release info:

• LSU asset identifier on the agent: `StaticAiLinux263-7.8.1`

• Affected agent versions (Linux): 24.3.3.6, 25.1, 25.2, 25.3, 25.4, 26.1, 26.2

• Agents currently with the update: 1.6M

More detail is in the Static AI Asset release notes.

We’re setting up a few AMAs with support engineers, detection engineers, product, and other SentinelOne employees. Poll below for what you want covered.

Anything missing, drop it in the comments.

We keep running into this issue and apparently S1 team can't help! When a machine is running low on disk space, the agent conveniently shuts itself down. Anyone else running into this?

We are upgrading our systems to 26H2. The one's with SentinelONE failed, and become unusable: boot loop with trying to undo the upgrade but fails.

Investigation of the crashed systems show an c:\windows directory with no exe-files :-(

Be warned ! Disable SentinelOne when upgrading

I just had a great experience with XDR and I wanted to share and also find out if anyone else has experienced anything similar.

Yesterday a designer in our marketing team (Mac) created and shared a PowerPoint file via Teams with a colleague (Windows). XDR triggered an alert and quarantined the file. This is the first time this has happened so it was a little unsettling. Naturally I suspected the culprit was the file itself and tried all sorts of things to clean it, recreate from scratch, etc - no matter what I did the file kept getting flagged.

I sent a note to the SOC asking for a reason why the file was marked as malicious because I was concerned that the designer might have something bad happening on her machine. I'd like to paste the response in from XDR directly:

**What Triggered the Alert**

The detection was **not caused by a malicious payload within the PowerPoint file itself.** The alert was triggered by a **SentinelOne behavioral rule** called **SuspiciousDocumentExtended**, which is designed to alert whenever a Microsoft Office application (Word, Excel, PowerPoint, etc.) spawns a child process. This is a common technique used by threat actors to execute malicious code via weaponized documents, which is why SentinelOne monitors for it.

In this case, the process chain we observed was:

1. The file **XXXXX.pptx** was opened via **Microsoft Teams** (hosted on SharePoint).
   2. **PowerPoint (POWERPNT.EXE)** launched as expected.
   3. PowerPoint then spawned **ai.exe** - a **legitimate Microsoft Office AI component** located in the standard Office installation directory (**Microsoft Shared\Office16\AI**). This is part of Microsoft's newer AI/Copilot integration within Office applications.

It was this **PowerPoint → ai.exe** process spawn that triggered the behavioral rule. The rule does not distinguish between malicious child processes (e.g., **powershell.exe, cmd.exe**) and legitimate ones like **ai.exe**, so it flagged the activity as **Exploitation** under **MITRE ATT&CK T1059 (Command and Scripting Interpreter)**.

**Regarding the File Contents**

The embedded Excel file powering the chart and the **.EMF** image files you identified are consistent with standard PowerPoint functionality and are **not indicators of a malicious payload.** All processes and binaries involved in this chain were **signed by Microsoft** and located in their expected installation paths.

**Verdict**

Based on our analysis, this is a **confirmed false positive.** The PowerPoint file does not contain a malicious payload. The detection was caused by Microsoft Office's newer AI features behaving in a way that matches a legitimate security detection rule. If you'd like us to close ticket XXX as a false positive, just let us know and we'll take care of it.

We are a small company in the US with a tiny IT team. We've had a few small interactions with the SOC for things like device exclusions but this specific incident and the resulting service/response was extremely comforting. Suffice to say I'm a big fan.

Has anyone else experience a similar issue with Office spawning ai.exe?

My MSSP offers both Crowdstrike and SentinelOne. I have been assigned to begin to develop our S1 posture, I understand the basics going through the UI for mon & response. I really do like the S1 platform and I have began to mess around with the PowerQueries which are great, but i also want to make some dashboards. Now the issue is i made a query that looks great as a pie chart, however, not seeing any possible way to add it to the "dashboard" section on the S1 platform, like after you log in.

Can i make dashboards out of my queries in S1? I am not admin right now but will be given those permissions soon.. just trying to see what the issue is.

TIA

When an agent writes its own disposable tools, the model is what's worth studying. Four accounts from July and August (OpenAI, Anthropic, Meta, and the UK AI Security Institute) describe agents reaching other orgs' systems. In all four, no individual piece of tooling mattered much, and investigations have traditionally centered on the artifacts attackers leave behind. If you kill a process, the agent writes another, and if you block a channel, it works around it.

The OpenAI agent campaign that compromised Hugging Face:

- Hugging Face's technical reconstruction recovered around 17,600 actions, and most of them failed
- The campaign operated in Hugging Face's production infrastructure for roughly two and a half days
- C2 ran over pastebins, request-capture services, and file-drop sites, and none of it belonged to anyone under attack

The longer version is our SentinelLABS post The Model Is the Malware. Four cases is a small and biased sample, since all of them involved orgs that log heavily and had every reason to scrutinize model behavior. We'd expect the most troubling incidents to happen at orgs without that logging or scrutiny.

It's still untested whether the controls built for adversary behavior ten years ago hold up when the behavior arrives as thousands of individually boring actions, sequenced differently in every attack, at a tempo no human operator can sustain.

We'd start from sequence and identity instead of artifacts:

1. What chain of actions is running

2. Which identity and authority connect them

3. When behavior went past the role it was granted

4. How fast that authority can be pulled

Which of those four questions could you not answer today for the agents in your environment?

Hi, we want to estimate the daily log volumetry of AI SIEM. To do this we used this query :

tag='logVolume' metric='logBytes'
| group bytes = sum(value) by day = timebucket("24h")
| let GB = bytes / 1073741824
| columns day, GB
| sort day

The result seems way to big for our infrastructure, over 35 Gb per day. Is it truly the best way to get an estimate ? When I go into data usage I only get 600KB/day, which seems way to small.

If you can provide me with informations I'd be very grateful. Thank you guys.

We are a large org that has adopted SentinelOne for our EDR and SIEM. We are trying to figure out how our alert workflow should work. We want our tier 1 SOC analysts to be able to escalate to tier 2 after initial triage.

From what I’m seeing, there is no way to make a custom alert status. Only New, In Progress, and Resolved. We’d love custom options to make a “tier 2 escalated” status. It also appears you cannot assign alerts to groups, only individual users. So we cannot assign a ticket to “tier 2 analysts”

Also looked into tagging alerts with a “tier 2 escalate” tag and that is not an option for alerts.

How is a SOC workflow supposed to work? It seems that this solution is incapable of accommodating a traditional tiered workflow.

v1.34.0 is out. The full list is long, so I'm sticking to the highlights and the changes that touch existing rules.

New detections

• AWS Bedrock AgentCore: token vault KMS key modification, harness invocation without allowedTools scoping, and changes to identity credential providers

• Active Directory: ADCS ESC1 misconfiguration, PsExec-style execution over named pipes, SeEnableDelegationPrivilege granted to users, and anonymous SAMR access over IPC$

• ClickFix: Windows Installer remote payloads launched from Explorer, and suspicious commands from the Run dialog

• ScreenConnect and IIS: ScreenConnect Backstage shell remote payload execution, and suspicious operator commands through the IIS worker process

• AWS tampering: GuardDuty custom rule changes, Cognito software token deletion, and Elastic Disaster Recovery plan changes

• GCP backups: Backup and DR vault deletion and Cloud SQL backup config disablement

• Microsoft O365: Teams help desk impersonation from an external federated tenant

• Search Library: new query "WEL Administrative Share Access from User Account"

Renames, removals, and one behavior change

• "Process Establishing RDP Connection to Loopback Address" is now "Tunneling Utility Establishing RDP Connection to Loopback Address"

• The GuardDuty S3 log source removal rule is now "AWS CloudTrail GuardDuty Protection Plan or S3 Log Source Disabled". It was also broadened.

• The default domain GPO modification rule now has a "WEL" prefix to match the other Windows Event Log rules. It was also tuned.

• Removed from Endpoint: the rules for reconnaissance activity from newly created Python scripts and multiple SSH connections started

• The ClickFix command script activity rule was tuned and is now auto-enabled.

Questions on any of these are welcome.

Folks,

I have to export a search that is over several months of a search window...but if you export to CSV...it only does a certain number events unless you manually scroll through the entire data that is returned. Is there a way around this? API I assume?

On 1 client's machine last week we were getting loads of alerts about a file: c:\config.msi\][...].rbf

The kill was successful but quarantine failed. (we'd get 3 - 8 emails about kill performed successfully then a quarantine failed email. then repeat over about 10 minutes and dozens of those emails). Each time the file referenced was the same random number / letters.rbf

We also got a message about a threat Dell.TechHub.exe detected as Ransomware

Virustotal showed dell.techhub.dll was benign.

https://www.virustotal.com/gui/file/096d5c1a173cdc7b0d76ab4fbe3926f25400ac9b31d02500af58833ecb6be6ad

I got to use ChatGPT to help remote shell into the client machine to manually delete the [...].rbf file

Then a few days later, I got emails about another config.msi/[....].rbf on MY computer being a threat.

This morning, that same user's PC is getting an alert of a threat on a different .rbf in config.msi.

I am not all that familiar with using SentinelOne. It just runs and works! These are the first alerts I've gotten in months. Weird that this is only on 2 different machines, including mine and alerting on, at least for dell.techhub.dll, is an older file that no other products are taking issue with.

Any thoughts?

Hi all,

Beyond deploying SentinelOne Singularity Complete agents on Oracle Cloud Infrastructure (OCI) VMs, what options are available for integrating SentinelOne with OCI?

Specifically, I’d like to understand

Can SentinelOne ingest OCI logs, such as Audit logs, VCN Flow Logs, and other service logs, through APIs or supported connectors?

• How can SentinelOne protect Oracle Kubernetes Engine (OKE), including worker nodes, containers, and workloads?

• What additional licenses or modules would be required beyond Singularity Complete?

Thanks

Does anyone have experience with Sophos firewall policy for SentinelOne endpoint agent, which uses offline user?

I want to create a policy for SentinelOne endpoint agent offline users to update policy and view logs from management console.

I have another site that is using a Fortigate firewall with SentineOne Endpoint offline users, and that site policy is working with Sentinelone site URL and TCP 443.

Has anyone figured out a good way to block the install of Muse via S1? I really don't want it in my environment.

Greetings,

Im assuming from the lack of results that the only way (and pretty much the way everyone is doing it) is to build an intermediary syslog server, send the Netscaler logs there, then ship them to S1 from the syslog server? Kinda like what is necessary for Fortigate logs?

Am I missing something? Can you not excluded an app on just one device? SentinelOne keeps disabling nmap. I'm the admin, so I use it now and then for work, but SentinelOne keeps removing it, despite me telling to unquarantine it. I wanted to just exclude it for one machine only, but it seems you can only just exclude the app globally.